Cisco Talos analyzed VOLTA-AUTODOXER, a Windows infostealer that collects passwords, sessions, wallet information, and other data before asking an LLM to assess a victim’s assets and security posture. Stolen sessions can enrich the profile with receipts and order history to infer identity and address. It switches models after refusals, but its theft functions also work without AI. A researcher told WIRED that the team had not tracked whether it was used in the wild, leaving deployment scale unconfirmed. Talos recommends restricting unnecessary automated browser launches and protecting credentials; suspected compromise calls for revoking affected tokens and changing passwords.